Cloudanix VulnDB

CVE-2026-93093

None

CVSS

—

EPSS

0.2%

Published

Sep 17, 2026

CISA due date

—

Cloudanix analysis

Schedule a fix SSVC: Track

A timing problem when setting up hardware communication channels can cause the system to crash if an interrupt arrives before everything is ready.

Exploitation
Local Privilege
Attacker needs
Local User
Complexity
Moderate
Impact
Denial Of Service
Component
OS kernel
Class
Race Condition
Remediation
Upgrade
Effort
Medium
Patch risk
Low

What it actually does

Race condition in arm_scmi transport setup (mailbox and SMC) allows early or spurious RX callbacks to dereference a NULL cinfo pointer or unassigned cinfo->handle before scmi_chan_setup publishes channel state.

Why it matters to the business

Kernel instability or crashes can occur on ARM systems during firmware channel initialization, reducing device availability and requiring reboots in affected environments.

How an attack unfolds

During mailbox_chan_setup or smc_chan_setup an interrupt can fire before the transport publishes its cinfo and handle; the RX path then follows the NULL pointer and faults.

How to fix it

Apply the upstream fix that assigns cinfo->handle before invoking transport callbacks, publishes channel state before requesting channels or IRQs, clears pointers on failure, and unwinds devres resources.

How to confirm the fix worked

Rebuild and boot with the patched kernel; confirm absence of SCMI NULL dereference faults in dmesg during repeated transport initialization and interrupt injection tests.

Typical attack path

  1. Initiate SCMI transport setup for mailbox or SMC channels
  2. Trigger early interrupt delivery before state publication
  3. Enter RX callback with uninitialized cinfo or handle
  4. Dereference NULL pointer causing kernel fault

How to detect it

Search kernel logs and dmesg for SCMI mailbox or SMC transport NULL pointer dereference messages occurring during early boot or firmware probe.

What your security team should do

  • Update Linux kernels containing the arm_scmi driver to the fixed version
  • Monitor boot logs on ARM SCMI platforms for related crashes
  • Test the patch in staging environments before broad rollout

The record

In the Linux kernel, the following vulnerability has been resolved: firmware: arm_scmi: Publish channel state before callbacks Transport setup can enable callbacks before the setup routine returns. mailbox_chan_setup() registers the mailbox client with mbox_request_channel(), and the mailbox controller startup path can enable interrupt delivery before SCMI mailbox channel state has been published. Similarly, smc_chan_setup() requests the optional A2P completion IRQ before the SMC transport has made its cinfo pointer visible. If a pending or spurious callback fires in those windows, the transport RX callback can dereference a NULL transport cinfo pointer. Publishing only the transport-private pointer is not sufficient either: an early callback can enter the SCMI core before scmi_chan_setup() has assigned cinfo->handle. The core derives scmi_info from cinfo->handle in the RX path, so a NULL handle can still fault even when the transport-private cinfo is valid. Assign cinfo->handle before invoking the transport setup callback. Publish the mailbox and SMC transport-private channel state before requesting the mailbox channels or IRQ, and clear the early-published pointers again on setup failure. Also unwind mailbox setup devres resources on failure so an optional RX setup error that is ignored by the core does not leave stale transport state behind.

Affected packages

Ecosystem Package Introduced Fixed